Sometimes it is very useful to filter most of the data coming out of each ESXi host. The destination logging servers will have cleaner logs as most junk is filtered out. This post will define the current defined filters and the source is from the VMware site itself.
Edit the primary log configuration file for each ESXi host and enable filtering /etc/vmsyslog.conf by changing the option enable_logfilters from false to true
enable_logfilters=true
Then edit the logfilters file /etc/vmware/logfilters and add specific filters. Following overview is an extract of 7.0u2 enviornment with NSX-T, however this needs to be tuned and adapted to your specific environment. This is just for example purposes.
# Copyright 2014, VMware, Inc. # To filter out excessive logging, add lines with the following syntax: # # numLogs | ident | logRegexp # # Any log line with a substring matching the regular expression logRegexp # will appear the first "numLogs" times that it's issued, but will be # ignored after that point. For example, the line: # # 5 | vmkernel | .* # # will ensure that only the first 5 vmkernel-related lines appear in the log # and others are ignored. # # All comparisons are case-sensitive. logRegexp must be a valid regular # expression confirming to the Python regular expression syntax. # Using '*' for the ident field implies that log messages from all sources # are a potential match. Multiple ident values can be specified in a comma # separated list. Consult /etc/vmsyslog.conf.d/*.conf for possible values # of ident. # # This feature should be used only in the case where a log statement is # spewing excessively. Filtering the log too aggressively may make # troubleshooting more difficult if it loses valuable information. 0 | Hostd | .*New error before the previous is handled 0 | Hostd | .*already registered 0 | Hostd | .*filePath empty 0 | Hostd | .*Allow _port.*8307 0 | Hostd | .*Redirect _port.*8307 0 | Hostd | .*vim.PerformanceManager.queryStats-330182 Status success 0 | vmkernel | .*failed with error Not supported 0 | nsx-opsagent | .*[GetNsxVimPid] nsx-vim Pid:.* 0 | nsx-opsagent | .*Function not implemented : 38.* 0 | Vpxa | .*_name=Resources:_remoteMoRef=vim.ResourcePool:ha-root-pool.* 0 | Vpxa | .*Starting to process resource notifications - new spec sync from vpxa 0 | localcli | .*VsanConfigStore:.* 0 | localcli | .*VsanInfoImpl.* 0 | localcli | .*OBJLIB-LIB.* 0 | vsansystem | .*Failed to GetNamespaceInfo.* 0 | Rhttpproxy | .*Allow _port.*9095 0 | vsantraceUrgent | .*DOMTraceCompSchedQueueStats.* 0 | Rhttpproxy | .*New proxy client.* 0 | vsansystem | .*VsanConfigStore: Get subCluster config.* 0 | Hostd | .*Calculated read I/O size.*is out of range.* 0 | Hostd | .*vim.InternalStatsCollector.queryLatestVmStats.* 0 | Rhttpproxy | .*Resolved endpoint.*8307 0 | Rhttpproxy | .*Resolved endpoint.*8089 0 | vmkernel | .*failed to subscribe callback.*on chain.* 0 | vmkernel | .*Failed to clear global property com.vmware.vswitch.vlanmtucheck.param on DVS.* 0 | vmkernel | .*IPMI SEL unavailable 0 | vmkernel | .*No such file or directory 0 | Hostd | .*VsanFileSystemImpl: vSAN datastore cid.* 0 | Vpxa | .*Originator.*FINISH.* 0 | Vpxa | .*Originator.*BEGIN.* 0 | Rhttpproxy | .*The client closed the stream, not unexpectedly. 0 | Rhttpproxy | .*Connected to localhost.*8089.* 0 | Rhttpproxy | .*Resolved endpoin.*9096 0 | vmkernel | .*Failed to clear global property com.vmware.vswitch.vlanmtucheck.deploy.* 0 | Hostd | .*Refresh function is not configured.* 0 | Hostd | .*failed to get objectId.*Operation not supported.* 0 | nsx-opsagent | .*nsx-esx.*framework.*nsx-vim Pid.* 0 | Hostd | .*congestion control algorithm: newreno 0 | Vpxa | .*ResourcePool:VpxaInvtHostResPoolListener::ConfigChanged 0 | Hostd | .*haTask.*Status success
Reload the syslog daemon, wait for a bit and you should see a drop of log entries with the definitions placed.
# esxcli system syslog reload